Cyber Defense eMagazine February Edition for 2023

companies. This is partly because the chains ’complexity has dramatically increased in recent
years. and because there is no easy way for organizations to measure and quantify supply chain
risks adequately.
But many initiatives are gaining momentum, and we should see adoption strengthen in 2023 with
best practices such as software bill of materials (SBOMs), guidances such as NIST’s
Cybersecurity Supply Chain Risk Management (C-SCRM), or frameworks like Google’s Security
Levels for Software Artifacts (SLSA) and Microsoft’s Supply Chain Consumption Framework
(S2C2F).
Supply chain security requires a holistic approach that shifts away from one-time third-party
assessments to real-time monitoring of third-party risks and vulnerabilities in packaged software
and firmware components. All these tools and frameworks converge toward the same objective:
provide transparency on all sides (software producers & consumers), and allow the investigation
of dependencies in the broadest sense (packages, vendors, registries, platforms etc.).
●
Open-source security will be front and center on the security radar
Among the various supply chain security concerns, open-source governance is certainly the most
urgent to implement for organizations. The 2021 Apache Log4j vulnerability was a wake-up call
for many, as it reminded us that the security of enterprise software depends on the security of the
open-source components on which they are based.
Malicious actors can still easily hijack open-source packages, or even weaponized by maintainers
themselves. In 2023, application security teams will focus on inventorying the OSS components
used in the software factories and using tools such as Software Composition Analysis to decide
if they should keep them.
●
Cloud security products and technology will accelerate
The growth of cloud services and the rise of DevOps create new opportunities for organizations.
However, as these deployments mature and more data and business functions are hosted in the
cloud, there is growing awareness that costly regulatory mistakes and damaging cyberattacks
can undo the benefits if security is not integrated into the transformation process.
As the principles of shared responsibility and zero trust become more familiar, we will see an
acceleration of security products at the intersection of cloud-based architectures and "secure-bydesign"
processes, which will focus on improving the developer experience and building greater
confidence.
●
Cybersecurity will become a business imperative across governing boards
As cyber threats continue to evolve and become more sophisticated, the role of the board of
directors in overseeing cyber risk is becoming increasingly important. By prioritizing customer
Cyber Defense eMagazine – February 2023 Edition 48
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.